CVE-2020-1938

Apache Tomcat is like the front door and hallway system for your web apps. This bug is specifically about a side-door called AJP: Tomcat treats calls made through AJP as “more trustworthy” than normal web traffic. If someone outside your business can reach that side-door, they may be able to pull up files they shouldn’t see and, in some setups, turn uploaded or controllable files into a way to run commands on the server.

This matters to you if you use or run Apache Tomcat with the AJP Connector enabled by default in versions such as Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50, or 7.0.0 to 7.0.99, or if you expose the AJP port to untrusted users. It also matters if you operate systems that ship these affected Tomcat versions, including Debian GNU/Linux communities and distributions like Astra Linux Special Edition, OpenSUSE Leap, and Fedora, plus the listed Oracle products that include Tomcat (e.g., Agile Engineering Data Management, Oracle Hospitality Guest Access, Oracle Communications Element Manager, Oracle Agile PLM).

This is RED because it’s critical and is listed as known exploited in the wild, with a public exploit available and a very high estimated chance of exploitation soon. If your Tomcat’s AJP port can be reached by someone outside your control (like the public internet, or a less-trusted network), you should treat it as urgent to close the gap today.